Agency Virus Protection Must Include System BackupBy: Andy Marken
For more than 20 years we’ve promoted firms in the computer and communications industry from mainframes to micros and software. For the past 10 years we’ve worked with CERFnet first to establish and promote the company as the western leg of the original NSFNet and most recently as the IP infrastructure and web hosting arm of AT&T.
With that background, we don’t think of ourselves as INet newbies.
Working so closely in the industry, we’ve been rather ambivalent regarding viruses, Trojan horses, hacking and worms. We’ve come to think of them as stupid prankish efforts and nuisances developed by a malicious few that have no real lives.
With more than 200 viruses being pushed onto the Internet each year and knowing that at some time a hard drive will crash, we’ve been pretty good about using our antivirus software and conducting system/network backups.
But when Worm.ExploreZip was propagated around the globe all of that changed. We’re no longer ambivalent and started to enforce our backup policies.
When ExploreZip entered the agency’s network it systematically destroyed every file on every drive…including the prior evening’s backup that was still in the drive. Fortunately, we had a full backup from two weeks earlier. Much of our recent work had been forwarded to clients for review, approval or posting. Internal review hard copies of work-in-progress could be used to construct the rest. Lost forever was client industry and competitive research.
The destruction wasn’t as bad as it could have been. But it still required more than 180 staff-hours to bring the system back to near-normal condition. It also meant lost time for others who couldn’t work until their systems were restored.
I couldn’t even blame anyone else in the agency for unleashing the worm since I was the one who received and attempted to open the deadly attachment. I didn’t even think twice when the message came in from a responsible editor we’ve worked with for years.
We got past the urge to call her every name in the book and going to her publisher to have her fired. She was an unwitting participant in the spread of the worm that crawled through our system.
But when it happened, all client work stopped. We focused on restoring the systems and backup. At 1 a.m. before going home, I checked my email again. Four more copies of Worm.ExploreZip came in from “people I knew.” Those files were trashed without being opened…I’m dumb, not stupid.
The “creative” prankster cost us thousands of dollars. ExploreZip probably cost AT&T, Boeing, General Motors, Proctor & Gamble, Intel and the thousands of other companies around the world that were affected millions of dollars in lost productivity and lost/destroyed intellectual property. Worms and viruses have an even greater impact on agencies because knowledge is our most critical asset. Losing that asset can be crippling and costly. It can even put the agency out of business.
Similar destruction occurred when the Melissa and Chernobyl viruses were introduced to the global network of networks. According to anti-virus experts, ExploreZip was a hybrid of the two viruses. Unlike most of the viruses that are set loose every week that are harmless nuisances, this was destructive. You can be certain that somewhere other “brilliant” whackos are busy developing better, more insidious and more destructive viruses.
Just as certainly as if the individual walks into your office smashing furniture and burning records these people destroy company property. But in the borderless world of the Internet there is no legal redress. As a result, all agency people can do is step up their vigilance and beef up their protection procedures.
Even though we use one of the most reputable anti-viral products available, it is impossible for these software producers to stay ahead of the problem. They actually have to receive a copy of the worm, Trojan horse or virus to develop a neutralizing solution. Depending upon the sophistication of the virus that can take hours or days. In the meantime, the destruction spreads through hundreds and thousands of systems and organizations.
In today’s business environment, network users share data, applications, files--and viruses.
It doesn’t take long to spread the virus throughout the workgroup. The Washington D.C.-based National Computer Security Association found that last year, there was an average of one new virus every other day, and they expect that figure to rise to six new viruses per day this year.
Despite this dismal forecast, there are ways agencies can protect their vital data against devastating computer viruses.
Recommended by Experts
A rigorous program of virus scanning and backing up data will help protect against serious infection. If a virus is detected, you will have clean copies of backup data ready to use. Unfortunately according to computer industry research few small to medium sized firms – which includes most agencies – don’t have adequate protective backup programs in place.
Without good backup protection agencies are taking an unnecessary risk. Today there are a number of low-cost, easy-to-use backup solutions that provide insurance against infection. Whether you use a CD-R, tape or high-capacity optical solution, choose the hardware and software that meets your data protection needs.
Keep in mind that data protection requires a complete solution. For us, that includes automated backup, data and media management and fast recovery techniques.
Automation Plays Key Role
The best way to guarantee consistent backup is with automated software.
Programs that incorporate built-in job creation, scheduling and automatic log-in access seem to be the best. Job creation should include both complete and differential backups for all network volumes. Complete backups backup all of the data on the network. Differentials save all files that have been created or altered since the last complete backup.
The software should allow you to specify the backup frequency and scheduled times. Once the jobs are scheduled, they run automatically—you don't have to manually initiate them each evening.
Automatic log-in gives the software unattended access to each server or system on the network and built-in security ensures that access to network workstations is only allowed while a backup job is running. You don't have to leave your systems logged on to your servers at night to complete network backup--which can be a significant security risk.
Managing your complete and differential backup media can be a time-consuming and complicated task. Some backup programs provide media management schemes that include a librarian and automatic tape rotation.
The librarian keeps track of what files were backed up and when, as well as the tape that was used. This helps you locate individual files, volumes or entire drives of information to quickly restore data.
Our backup program now includes a regular rotation schedule and tapes are rotated every day over a three-week period.
Selection of rotation times is your decision, and depends on such things as the size of your network and the importance of your data.
Window of Time
The combination of rotating backup tapes and regularly scheduled backup gives you restore-any-day capabilities. Restore-any-day allows you to go back in time to erase any virus damage to your system data.
The more backup media you use in the rotation sequence, the longer your window of time. If you only have three days of backup tapes, you can only "go back in time" three days for data recovery. If a virus entered your network four days ago, you're in trouble.
Today a 30GB tape can cost less than $50. 650MB CD-R media costs $1-$3 per disc. Now consider the value of the information sitting on your agency’s computers. A few hundred dollars invested in storage media seems like a worthwhile investment.
While comprehensive backup software will protect your company from losing vital data in the event of a virus attack, it’s restoration capabilities allow you to get back to serving clients.
Two vital features are needed in backup and recovery programs for fast restoration after a disaster. The first is the ability restore the operating environment in a single step. Having to reload your NOS, OS and backup software only adds time and frustration to the process.
Better solutions allow you to restore all operating environments and your backup program from a single floppy disk specifically designed for restoration/rescue. Since the software records the dates of the backups, you can indicate the day before the virus attack and quickly find the versions you need.
Lost Data, Lost Business
With the proliferation of destructive worms and viruses every agency – large or small – can suffer irreparable damage to their most critical resource – data. A recent study by the Gallup Group found that of companies that lose a significant amount of data, 43 percent close down immediately and 90 percent are out of business within two years…we don’t intend on becoming one of those statistics.
The risk of virus exposure is increasing along with the destructive nature of these attacks. A sound backup/recovery program is the best insurance policy agencies have for protecting their vital data--and their future. Vigilance and backup should make it easier and less stressful when you are hit.
© Copyright 1999, G.A.Marken, Marken Communications
The author assumes full responsibility for the contents of this article and retains all of its property rights. MarcommWise publishes it here with the permission of the author. MarcomWise assumes no responsibility for the article's contents.